fix(kpi): restack ambiguous provenance JSON bytes on current main

[seonghobae]

Purpose

Rebuild only PR #315's strict production-KPI provenance byte-integrity hardening onto current protected main after #305 advanced the base. No predecessor CI, review, scanner, coverage, production-KPI, release, deployment, legal-rights, or acquisition authority transfers.

Exact construction

• protected main immediately before publication: 534bf1708a6277c443867e87092ac5f2c05ea490;
• source PR fix(kpi): restack ambiguous provenance JSON bytes on current main #315 exact unchanged head at the pre-write refetch: cfc5dd4a2e7fc40459f3b415d22be3e2e53217ca;
• successor exact head: 7f3519161d2b650cbccd8a4b8300fe53bbcbda4a;
• ancestry: exactly 1 commit ahead / 0 behind protected main, merge base exactly protected main;
• net scope: exactly two paths: scripts/kpi-gate.mjs and test/kpi-provenance-json-integrity.test.ts.

Protected-main movement since #315's prior base changes only the distributed rate-limiter source/tests, so this successor overlays #315's exact two head blobs without overwriting intervening protected bytes.

KPI provenance integrity contract

Strict provenance is kept as raw bytes until fatal UTF-8 decoding, then rejected on escape-equivalent duplicate decoded object names before JSON.parse or production-source identity, collection timestamp, record count, SHA-256/byte-size, verified snapshot, final identity, and least-authority KPI child-process decisions. Existing production-source/provenance binding remains unchanged. This does not synthesize a real 30-day production KPI window.

Evidence boundary

Keep Draft until this unchanged exact head receives fresh terminal-success application ci, reviewer-ci, protected-base-eligible central Security Scan, exact 100% owned production statement/branch/function/line coverage with realistic tests, and zero valid unresolved findings. Pending, queued, skipped, absent, neutral, failed, cancelled, stale, predecessor, status-only, model-only, or rate-limited evidence is non-passing.

Immediately before Ready or merge, independently re-resolve protected main, exact head/base/ancestry, formal reviews/threads, checks and checkout SHAs, live rulesets, central Security Scan revision/triggers/base filters/thresholds, releases, and writer state.

Supersedes #315 only after fresh exact-head verification and protected integration. Related: #3.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 9d343b67-b738-4960-aa10-e0a1ef9a2f1e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}